libs/web: allow percent sign in urls

[project/luci.git] / libs / web / luasrc / dispatcher.lua

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index c863d9f..0f49b90 100644 (file)
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -34,6 +34,9 @@ local nixio = require "nixio", require "nixio.util"
 
 module("luci.dispatcher", package.seeall)
 context = util.threadlocal()
+uci = require "luci.model.uci"
+i18n = require "luci.i18n"
+_M.fs = fs
 
 authenticator = {}
 
@@ -49,11 +52,25 @@ local fi
 -- @return             Relative URL
 function build_url(...)
        local path = {...}
-       local sn = http.getenv("SCRIPT_NAME") or ""
+       local url = { http.getenv("SCRIPT_NAME") or "" }
+
+       local k, v
        for k, v in pairs(context.urltoken) do
-               sn = sn .. "/;" .. k .. "=" .. http.urlencode(v)
+               url[#url+1] = "/;"
+               url[#url+1] = http.urlencode(k)
+               url[#url+1] = "="
+               url[#url+1] = http.urlencode(v)
+       end
+
+       local p
+       for _, p in ipairs(path) do
+               if p:match("^[a-zA-Z0-9_%-%.%%/,;]+$") then
+                       url[#url+1] = "/"
+                       url[#url+1] = p
+               end
        end
-       return sn .. ((#path > 0) and "/" .. table.concat(path, "/") or "")
+
+       return table.concat(url, "")
 end
 
 --- Send a 404 error code and render the "error404" template if available.
@@ -108,13 +125,21 @@ end
 
 --- Dispatch an HTTP request.
 -- @param request      LuCI HTTP Request object
-function httpdispatch(request)
+function httpdispatch(request, prefix)
        luci.http.context.request = request
-       context.request = {}
+
+       local r = {}
+       context.request = r
        local pathinfo = http.urldecode(request:getenv("PATH_INFO") or "", true)
 
+       if prefix then
+               for _, node in ipairs(prefix) do
+                       r[#r+1] = node
+               end
+       end
+
        for node in pathinfo:gmatch("[^/]+") do
-               table.insert(context.request, node)
+               r[#r+1] = node
        end
 
        local stat, err = util.coxpcall(function()
@@ -138,7 +163,7 @@ function dispatch(request)
        assert(conf.main,
                "/etc/config/luci seems to be corrupt, unable to find section 'main'")
 
-       local lang = conf.main.lang
+       local lang = conf.main.lang or "auto"
        if lang == "auto" then
                local aclang = http.getenv("HTTP_ACCEPT_LANGUAGE") or ""
                for lpat in aclang:gmatch("[%w-]+") do
@@ -148,7 +173,7 @@ function dispatch(request)
                                break
                        end
                end
-        end
+       end
        require "luci.i18n".setlanguage(lang)
 
        local c = ctx.tree
@@ -170,7 +195,7 @@ function dispatch(request)
        for i, s in ipairs(request) do
                local tkey, tval
                if t then
-                       tkey, tval = s:match(";(%w+)=(.*)")
+                       tkey, tval = s:match(";(%w+)=([a-fA-F0-9]*)")
                end
 
                if tkey then
@@ -200,7 +225,7 @@ function dispatch(request)
                end
        end
 
-       ctx.requestpath = freq
+       ctx.requestpath = ctx.requestpath or freq
        ctx.path = preq
 
        if track.i18n then
@@ -211,8 +236,7 @@ function dispatch(request)
        if (c and c.index) or not track.notemplate then
                local tpl = require("luci.template")
                local media = track.mediaurlbase or luci.config.main.mediaurlbase
-               if not tpl.Template("themes/%s/header" % fs.basename(media)) then 
-               --if not pcall(tpl.Template, "themes/%s/header" % fs.basename(media)) then
+               if not pcall(tpl.Template, "themes/%s/header" % fs.basename(media)) then
                        media = nil
                        for name, theme in pairs(luci.config.themes) do
                                if name:sub(1,1) ~= "." and pcall(tpl.Template,
@@ -227,7 +251,9 @@ function dispatch(request)
                   write       = luci.http.write;
                   include     = function(name) tpl.Template(name):render(getfenv(2)) end;
                   translate   = function(...) return require("luci.i18n").translate(...) end;
+                  export      = function(k, v) if tpl.context.viewns[k] == nil then tpl.context.viewns[k] = v end end;
                   striptags   = util.striptags;
+                  pcdata      = util.pcdata;
                   media       = media;
                   theme       = fs.basename(media);
                   resource    = luci.config.main.resourcebase
@@ -258,7 +284,7 @@ function dispatch(request)
                local verifytoken = false
                if not sess then
                        sess = luci.http.getcookie("sysauth")
-                       sess = sess and sess:match("^[a-f0-9]+$")
+                       sess = sess and sess:match("^[a-f0-9]*$")
                        verifytoken = true
                end
 
@@ -272,6 +298,12 @@ function dispatch(request)
                        if not verifytoken or ctx.urltoken.stok == sdat.token then
                                user = sdat.user
                        end
+               else
+                       local eu = http.getenv("HTTP_AUTH_USER")
+                       local ep = http.getenv("HTTP_AUTH_PASS")
+                       if eu and ep and luci.sys.user.checkpasswd(eu, ep) then
+                               authen = function() return eu end
+                       end
                end
 
                if not util.contains(accs, user) then
@@ -293,6 +325,7 @@ function dispatch(request)
                                        end
                                        luci.http.header("Set-Cookie", "sysauth=" .. sid.."; path="..build_url())
                                        ctx.authsession = sid
+                                       ctx.authuser = user
                                end
                        else
                                luci.http.status(403, "Forbidden")
@@ -300,6 +333,7 @@ function dispatch(request)
                        end
                else
                        ctx.authsession = sess
+                       ctx.authuser = user
                end
        end
 
@@ -459,7 +493,7 @@ function createtree()
        ctx.modifiers = modi
 
        -- Load default translation
-       require "luci.i18n".loadc("default")
+       require "luci.i18n".loadc("base")
 
        local scope = setmetatable({}, {__index = luci.dispatcher})